Slashdot videos: Now with more Slashdot!

View

Discuss

Share

We've improved Slashdot's video section; now you can view our video interviews, product close-ups and site visits with all the usual Slashdot options to comment, share, etc. No more walled garden! It's a work in progress -- we hope you'll check it out (Learn more about the recent updates).

MrSeb writes "Lawmakers in Washington have turned their sights on mobile device tracking, proposing legislation aimed at making it much harder for companies to track you without consent. The Mobile Device Privacy Act (PDF) makes it illegal for companies to monitor device users without their expressed consent. The bill was introduced Thursday by Massachusetts Democrat Representative Edward Markey, co-Chair of the Bi-Partisan Congressional Privacy Caucus. Much of the impetus for the bill came from last year's Carrier IQ debacle, where it emerged that the company's software was found to exist on both iOS and Android devices on AT&T and Sprint's networks. While the company denied any wrongdoing, the software captured keystrokes and sent the details of your device usage back to the carriers. If passed, the legislation would require the disclosure of including tracking software at the time of the purchase of the phone, or during ownership if a software update or app would add such software to the device, and the consumer gains the right to refuse to be tracked. This disclosure must include what types of information is collected, who it is transmitted to, and how it will be used."

I have an iPhone 3GS on AT&T. How do I check if Carrier IQ is on it? Did that program show up "randomly" or only on new phones after a certain date?

Carrier IQ exists on several levels. For Android, it went particularly deep, enough to be able to capture the key codes (whe you typed). For iOS, it couldn't go as deep, so it was used mostly for its ability to collect diagnostic data ("send diagnostic information to Apple").

I believe it came in around iOS 4 or so, but 5 I think eviscerated it as Apple implemented it themselves. If not, the sure way is to just disable sending diagnostic information to Apple.

It was disabled by default on iOS. In order to enable it you had to go into your debugging settings (General - About - Diagnostic and Usage Data), and turn it on. You also had to allow to upload the data to Apple. Unless both of those were on, it wasn't able to do anything.

It was removed completely in iOS 5 meaning you can't even turn it on (the option is grayed out).

It doesn't mean that you get to disapprove of the monitoring software and still get to to keep the device or maintain service to the device. Where have you ever seen the ability to selectively accept or decline the boilerplate provisions of your contract? Check this box saying you agree to all the terms here in or we can terminate your contract and require you pay your Early Termination Fee.

The biggest hole is with manufacturer installed monitoring software. Its not at all clear that disclosure would be required if it was on the device at the point of manufacture as opposed to being added later (2a3).

Further the Exemptions clause (2d) is so broad the you could drive a truck thru it. No disclosure necessary if there was a "reasonable expectation" that monitoring software might exist on the device. What precisely is Reasonable? Some mumbo-jumbo about service quality management buried in the fine print?

Its a good start, it just needs to be tougher.Simply prohibit carrier or manufacturer installation of such software outright.Make it an after market package you can sign up for if you have problems and uninstall after the fact.

Sectoral data protection laws that take ages to be adopted always after the sad fact while Hydra grows another 7 heads... are part of the problem, not the solution.

Make "thou shalt not snoop" the law of the land, with narrow exceptions that require prior consent (for cases other than self-defense), imposing jailtime and fines on all who infringe upon anyone's privacy.

Oh, it'll pass, but disclosure will be buried in a EULA or thick contract, and you won't be prompted if you want to remove it. You'll have to ask with forward knowledge that the software exists. At least, that's what the wording of the summary suggests. (maybe I should RTFA...)

All this will due is put some disclosure into EULA's, certainly buried way toward the back in small print, because everyone knows that users read EULA's before giving their consent, right? But the cat is out of the bag, and this won't cause vendors to stop trying to collect or sell your data. Android is already pretty good at this, by giving users a pretty detailed list of what information an app has access to at the time the app is installed. I've been alarmed at the number of apps that want permission

(1) The disclosures shall be made in a clear andconspicuous manner, to be determined by the Federal Trade Commission.

(2) The disclosures shall be displayed in a clear and conspicuous manner on the website of a person
required to make such disclosures, except that if
such person does not maintain a website, such person shall file such disclosures with the appropriate
Commission.

So probably not in a EULA, although it would be up to the FTC to make the appropriate regulation. In any case, they also have to report it to the FTC, and on their website, so people will be able to know about it, which is a significant improvement over the current situation.

Android is already pretty good at this, by giving users a pretty detailed list of what information an app has access to at the time the app is installed

Well, not really all that good.Its there, but does your mom understand it?

Why should merely mentioning that the Game you just installed has access to your address book be enough?

Android needs, (and there is some movement towards this) a much finer grain control, where an app will be subject to a permissions modulethat the user can control to deny access to specific things at the OS level. If said games stop working because the users deny access tocontacts or emails, thats fine. At least we know where we s

A legal solution is fine, but it isn't sufficient by itself. It's like trying to legalize that I don't receive spam. Well, the law can't really do that (it's tried). I can only do that myself, by being careful with who I give my email to.

So this seems like the same idea. Such a law doesn't hurt, but it isn't enough, by itself. What's needed is a technical infrastructure where the people who buy mobile products fully control them, from the hardware on up, rather than some phone carrier controlling them. Then I can blow away whatever crapware comes with the device by installing my own operating system and only running software I trust.

As long as the device is secured against the people who buy them, there can be no trust that we have any privacy.

If they wanted to pass a better law, they'd have passed one like that: carriers cannot secure phones against who buys the phones.

How about a law that says if you cannot compile and build your own phone software you have no business having a mobile phone?

How about a similar law that says if you cannot build and install Linux from source you cannot have a computer? Proof of such ability results in a federal license which is then required to buy any computer or computer parts. And the penalty for selling such devices to anyone without a license is banishment to some tiny island without Internet access.

I've said it once, and I'll say it again: carriers have no busyness selling mobile phones, they need to be separate things, to avoid vendor-lock in, and plenty of other issues.I'm still surprised how many people in the US seem to buy their phones from their carriers really. Phones need to be sold in closed boxes on default factory settings, and sold by phone-selling companies. Otherwise, there's a severe conflict of interests.Imagine if PCs were sold by ISPs, and TVs by cable-companies!

I'm still surprised how many people in the US seem to buy their phones from their carriers really.

Faced with the choice of a $700 phone and $50/month service, or a $99 phone and $89/month + 2-year service contract, most people will choose the subsidized option. Most, as in just about everybody. And if I bring my own phone to a provider, they're still going to charge me the higher price, so I might as well get the subsidized phone.

You're onto something about PCs from ISPs. Notice all the netbooks for sale at cell phone stores? I think that's the future business model for computers, especially with

IMO it's not just subsidies. It's also that every network in the US is using incompatible standards. Verizon and Sprint are CDMA; AT&T and T-Mobile are GSM. But if you want anything more than 2G you then get into a mess of UTMS vs LTE vs HSPA[+] vs WiMax vs CDMA2000 vs who knows what else. Even then if you have the right interface you need it to be on the correct frequency.

Making a phone that works on all the standards would be prohibitive. Deciphering all the standards to get a compatible handset

For a while Telus (landline, phone & internet company) was giving away "free computers" to people that signed up for a certain level of internet access. As far as I know it wasn't THAT popular, but I do know at least 1 person (completely non-technical user) that got the laptop offer.

It's ok as long as they cops are doing it? We need a it's not legal to track people without a warrant for anybody. Exceptions for with consent for research or internally for network development (no sending the data over the wall to advertising).

Disclosure is pointless. Firstly, it doesn't prevent the carrier from installing spyware on your device. Secondly, it's often worded in a way which leaves the customer clueless:

"..In agreeing to these terms, you authorizeSprint to collect the necessary data needed to improveand maintain equipment, networks, and customer service.At no time will Sprint share this information with unaffiliatedthird-parties, or individuals"

People just "meh" at shit like this and click through it. The lawyers know it too. I say, If you're going to raise hell about CarrierIQ, make a policy that requires the individual to Opt-in.

It still doesn't help to have an op-in. The carriers will just require you to op-in before using any of the features of the phone. Since all carriers will have nearly identical EULAs you will be required to op-in if you want to communicate in the modern world.

Carriers will merely put this into their TOS or other contacts with fine print that a lot people don't read but sign anyways. Mandate a specific title and format of the text so people actually notice it before they just agree. Better yet, mandate it a yes or no question on the agreement. It'd be no different than the customer improvement prompt you get for certain software to know how you use it.

If the carrier can not capture keystrokes. How would it know that you want to make a phone call or what the text should say or what website to display? Sometimes I wonder about privacy freaks... Maybe I shouldn't do that.... They might pass a thought law.... Never mind...

this is about the carrier getting a full keystroke log from your phone

so if you typed something decided it was stupid edited it to something sane THE CARRIER WOULD GET BOTH VERSIONS

so lets say you decided to text somebody half drunk after knocking over a convenience store. you decide to NOT tell the world that you just hit %store% but decided to say something else. The Police could get the Evidence version.